amadan
Propose explicit historical schema commitments for native provisioning
1 file changed,
+86
−0
implementation/legacy-schema-binding/proposal.json+86 −0
CI passed — run details
diff --git a/implementation/legacy-schema-binding/proposal.json b/implementation/legacy-schema-binding/proposal.json| new file mode 100644 |
| index 0000000..3be70ed |
| --- /dev/null |
| +++ b/implementation/legacy-schema-binding/proposal.json |
| @@ -0,0 +1,86 @@ |
| +{ |
| + "status": "Proposed; independent Fable review required before implementation. No runtime authority is enabled by this proposal.", |
| + "task": "Home61: bind historical-empty schema recognition to independently enrolled, signed and verified native launches, and repeat it in readonly result verification.", |
| + "source_baseline": "549a277773e03c42166c3ebde84589b4a2156359 on feat-legacy-schema-profile. This design branch starts from main7d68e87 as AGENTS requires; baseline implementation is a dependency, not implicitly approved for merge.", |
| + "observed": { |
| + "at": "2026-09-11T19:49:10Z", |
| + "profile": "legacy-directory-v1", |
| + "match": true, |
| + "legacy_credentials_present": false, |
| + "limits": "One diagnostic read snapshot only. Six legacy-only tables were empty; shared sessions were not part of the occupancy test. Diagnostic results confer no authority and are never read by the operator to select a profile." |
| + }, |
| + "decision": "Use explicit versioned schema commitments. Do not autodetect, accept extra ledger entries generically, or use an environment flag by itself to select historical compatibility.", |
| + "catalog": { |
| + "profiles": [ |
| + "credential-current-v1", |
| + "directory-current-v1", |
| + "directory-historical-empty-v1" |
| + ], |
| + "meaning": "Each immutable profile binds its role, full exact migration ID/checksum set, full exact SQLite schema objects (including ledger and replication objects), explicitly empty table set, and validation-policy version. A changed schema/policy requires a new profile identity and digest; names never silently acquire new meanings.", |
| + "digest": "SHA256 lower-case hex of deterministic canonical JSON manifest bytes. Freeze the manifest, original migration provenance and expected digest in source, and test against real sequential migration replay. Historical ordering is BootSchema then directory runtime migrations, with identical-SQL duplicate IDs deduplicated by first occurrence; never use migrate.Merge directly on overlapping sets.", |
| + "historical_empty_tables": [ |
| + "people", |
| + "signin_links", |
| + "passkey_credentials", |
| + "passkey_challenges", |
| + "passkey_pending", |
| + "passkey_recovery_codes" |
| + ], |
| + "sessions": "Preserve the shared sessions table and its data exactly. Historical profile does not prove session confidentiality, key custody or credential absence outside the six tables. Existing readonly session/key continuity checks remain mandatory. Any session cleanup or custody transition is separate reviewed work.", |
| + "separation": "Keep diagnostic_profiles and its accepted-embed guard unchanged. New admission manifests are a separate catalog; do not import diagnostic result types, log readers or startup state into admission. A bounded pure schema comparator can be shared after review, but observations cannot authorize profile selection." |
| + }, |
| + "enrollment": { |
| + "new_version": "InstallationPlan version2 adds schema_profile and schema_manifest_digest to each role target. Closed JSON and exact role/profile/digest matching. Version1 retains its existing fresh-only semantics; it cannot authorize historical compatibility.", |
| + "authority": "The existing EnrollPlan is local preparation only. Its encrypted signed journal commits the profile, release artifact and protected environment digest, but does not assert owner approval, held fence, worker eligibility or correct key custody.", |
| + "immutability": "Prepared operations must agree with the enrolled target. Never rewrite an existing plan, fill missing fields from an inspected database, or overwrite an in-flight/ambiguous operation to change its profile. A profile transition requires a separately reviewed reenrollment/lifecycle operation; none is introduced here.", |
| + "manifest_availability": "The full known manifest must be included in the reviewed release. Unknown IDs, digest mismatch, wrong role, partial profiles, empty fields and attempts to select historical on a credential role refuse." |
| + }, |
| + "signed_request": { |
| + "version2": "Add the same schema_profile and schema_manifest_digest pair to version2 operator Authorization and version2 InspectChallenge. Verify equality with independently pinned expectations before database open. Include them in signature input, authorization head and journal replay checks; inspect uses its existing distinct signature context.", |
| + "version1": "Preserve exact existing canonical v1 bytes with explicit version-specific wire structs/decoders. Existing v1 signature/recovery tests must remain valid. V1 always means existing fresh-only behavior, never a fallback from a rejected v2 request.", |
| + "pins": "Extend verified configuration with explicit profile commitments. A v2 request must match v2 protected command configuration and the enrolled plan. Do not trust a signed field alone: a trusted provisioner key may sign for several targets, so role/origin/installation/registry/device/action binding and exact enrolled profile all still apply.", |
| + "recovery": "Retain existing authentic expired request recovery semantics. Repeat the selected exact schema and occupancy check before returning an idempotent result; unexpected drift or new legacy rows remains refused even on replay. No resigning or profile substitution for ambiguous operations." |
| + }, |
| + "launch_binding": { |
| + "operator": "The platform launch already binds fd0 input SHA256, artifact digest and protected environment envelope digest. Keep its shared transport wire unchanged. The independently verified platform enrollment/owner/fence/lease path must bind those exact values to the plan, including the environment containing protected command profile pins. Home verifies signed input and matching protected pins before constructing the database connector.", |
| + "missing_authority": "Current descriptor checks and a non-nil callback do not establish that platform authority. Until the runtime integration verifies the plan/environment/artifact/attempt binding plus isolation/IAM eligibility, no production code path may select the historical profile. Do not add a HOME_ALLOW_LEGACY flag or relax the currently mounted operatorSchemaCheck.", |
| + "readonly": "Readonly expectation gains the exact immutable schema commitment inside its verified launch/enrollment evidence, not an unsigned optional argument. It must agree with the operation commitment and enrolled target on both pre-open and final verification. Also retain pinned database bytes, inode/device, artifact, key fingerprints, operator state/head, witness, generation and attempt identity checks.", |
| + "unavailable": "The readonly production verifier is not implemented today. Keep the checker unmounted and historical operator selection unavailable until the verified adapter exists. Synthetic tests may exercise a private implementation, but must not be described as runtime authorization." |
| + }, |
| + "database_checks": { |
| + "before_mutation": "After verified launch selection, run exact ledger/schema checks and all six empty-table EXISTS checks on the same connection inside the existing BEGIN IMMEDIATE transaction before replay or mutation. Keep foreign-key checks, replication shape, row and byte budgets, state/sequence/key checks. No schema migration or data cleanup from operator/checker.", |
| + "readonly": "Use the same selected immutable manifest and occupancy conditions in the same readonly transaction. Run all existing semantic and key-continuity checks as well. The two paths must not select profiles independently from observed database state.", |
| + "bounds": "Use diagnostic-grade SQL CASE type/byte limits before materializing schema/ledger strings: IDs/names/table names256 bytes, type16, checksum64, SQL65536, at most1000 rows using LIMIT1001. Coalesce SQLite autoindex NULL SQL to empty before checking. Reject unknown/missing/duplicate/oversized/partial/changed objects. Occupancy queries select only EXISTS(SELECT1) over constant table names after exact schema equality.", |
| + "cleanup": "Honor bounded cancellation; check all row and transaction closure errors. Any uncertain BEGIN failure requires connection eviction before returning it to a pool; failed rollback also evicts. Do not claim a successful unchanged-byte result until readonly driver and descriptor closure plus final byte comparison and authority recheck succeed.", |
| + "preservation": "Serving migrations stay role-specific and additive. New directory databases retain their fresh profile; never install credential tables to make a new directory match the historical profile. No deletion, rekey, session mutation, table drop, ledger rewrite or historical credential copy." |
| + }, |
| + "stages": [ |
| + { |
| + "stage": "A: offline commitments and schema checker", |
| + "deliverable": "Versioned catalog, local plan and signed wire binding with private schema checks and adversarial tests. Production operator accepts existing fresh-only profiles; readonly checker remains unmounted. No claim that task61 as a whole is complete." |
| + }, |
| + { |
| + "stage": "B: verified adapter integration", |
| + "deliverable": "After platform126/132 prerequisites, connect protected environment and exact signed request/enrolled target to opaque verified profile selection. Bind readonly pre/post expectations and make the historical profile reachable only through this path. Independent design/source review and exact CI before deployment." |
| + }, |
| + { |
| + "stage": "C: observed execution and recovery", |
| + "deliverable": "Verify isolation including console, enroll authority through reviewed lifecycle, execute a bounded approved operation, repeat readonly checks and prove restore/recovery before public gateway cutover. Report only actual verified deployments." |
| + } |
| + ], |
| + "tests": [ |
| + "Exact frozen fresh credential, fresh directory and historical-empty profile replay; prevent manifest/provenance/digest drift.", |
| + "Every wrong/unknown/missing profile or digest; wrong role; v1 with legacy field; v2 missing commitment; duplicate/unknown JSON members; noncanonical representations; unchanged v1 signature bytes.", |
| + "Tampered signature/profile/digest; signed request for another enrolled target; inspect commitment mismatch; plan journal replay substitution; same key across multiple profile targets.", |
| + "Individually occupy each legacy-only table; preserve nonempty shared sessions and unrelated logical data; reject any occupancy on mutation, replay, inspect and readonly verification.", |
| + "Exact ledger mismatch, modified checksum/comment, missing/extra/partial objects, triggers/views/indexes, malformed/oversized metadata, foreign-key/replication drift and resource limits.", |
| + "Post-diagnostic occupancy and post-operation drift still refuse; no diagnostic output or request flag can reach admission.", |
| + "Failure before transaction writes or cached result return; BEGIN uncertainty and rollback failure evict; cancellation and closure errors refuse; readonly final bytes unchanged.", |
| + "Guard that production dispatch remains fresh-only until the real verified adapter is connected. Tests for adapter must cover missing/stale/incorrect plan, owner approval, held fence, lease, environment, artifact, attempt identity, profile and readonly expectation.", |
| + "Required full Home tests, race, formatting, vet, build, exact source CI and Fable source review for each implemented stage; no runtime or public-gateway claim from codec tests." |
| + ], |
| + "platform_work_to_check": { |
| + "126": "isolated-exec build readiness, dev-fleet rollout, explicit migration of existing instances, observed nested/ready layout and peer data/process isolation including the console. External routes need supervisor isolation evidence. Revert/downgrade must refuse with active worker authority.", |
| + "132": "Worker enrollment/authentication and head lifecycle CAS, independent IAM writer boundary, eligibility checks before private input/token use, accepted result reconciliation and revocation/closure/reclaim. Merged codec/store7fdcb6d is inert and does not supply this runtime." |
| + } |
| +} |